mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-06 15:31:38 +01:00
Compare commits
30 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
6d23534ee0 | ||
|
|
d2e7ac9348 | ||
|
|
2125037a3c | ||
|
|
ed7e5e428e | ||
|
|
d28a425673 | ||
|
|
a6fa846afc | ||
|
|
4380e78981 | ||
|
|
be82243966 | ||
|
|
f9886448b6 | ||
|
|
0eceb85e7d | ||
|
|
1ef4a861ac | ||
|
|
3b90533063 | ||
|
|
1349181d80 | ||
|
|
e1b84898c5 | ||
|
|
63a1e2568e | ||
|
|
ca4b1da84f | ||
|
|
ff462ab0dc | ||
|
|
4f2a8aeee4 | ||
|
|
c5ab1b81fe | ||
|
|
9d7866480c | ||
|
|
9a6d2409a6 | ||
|
|
f758293241 | ||
|
|
6321ff50a0 | ||
|
|
5fbf86b6bc | ||
|
|
6e68f7f28c | ||
|
|
41d40c9b73 | ||
|
|
cef11acbae | ||
|
|
6e5ef639c2 | ||
|
|
65b0ca5480 | ||
|
|
39565c7cfd |
@@ -129,8 +129,9 @@ variables:
|
||||
options:
|
||||
- "yes"
|
||||
- "no"
|
||||
TESTS_PROJECT_URL:
|
||||
description: "URL of the E2E-test Gitlab project API with project ID."
|
||||
TESTS_BRANCH:
|
||||
description: "Branch of E2E-tests on which the test pipeline is triggered"
|
||||
value: "main"
|
||||
# please use the following set of variables with normalized names:
|
||||
DOMAIN: "${NAMESPACE}.${CLUSTER}.${BASE_DOMAIN}"
|
||||
ISTIO_DOMAIN: "${NAMESPACE}.istio.${CLUSTER}.${BASE_DOMAIN}"
|
||||
@@ -408,51 +409,50 @@ run-tests:
|
||||
when: "always"
|
||||
script:
|
||||
- |
|
||||
COMPONENTS="login or portal or profile or navigation"
|
||||
if [ "${DEPLOY_ALL_COMPONENTS}" != "no" ]; then
|
||||
COMPONENTS="${COMPONENTS} or collabora or ics or jitsi or keycloak or nextcloud or openproject or ox or ucs \
|
||||
or xwiki"
|
||||
else
|
||||
[ "${DEPLOY_COLLABORA}" != "no" ] && COMPONENTS="${COMPONENTS} or collabora"
|
||||
[ "${DEPLOY_ICS}" != "no" ] && COMPONENTS="${COMPONENTS} or ics"
|
||||
[ "${DEPLOY_JITSI}" != "no" ] && COMPONENTS="${COMPONENTS} or jitsi"
|
||||
[ "${DEPLOY_KEYCLOAK}" != "no" ] && COMPONENTS="${COMPONENTS} or keycloak"
|
||||
[ "${DEPLOY_NEXTCLOUD}" != "no" ] && COMPONENTS="${COMPONENTS} or nextcloud"
|
||||
[ "${DEPLOY_OPENPROJECT}" != "no" ] && COMPONENTS="${COMPONENTS} or openproject"
|
||||
[ "${DEPLOY_OX}" != "no" ] && COMPONENTS="${COMPONENTS} or ox"
|
||||
[ "${DEPLOY_UCS}" != "no" ] && COMPONENTS="${COMPONENTS} or ucs"
|
||||
[ "${DEPLOY_XWIKI}" != "no" ] && COMPONENTS="${COMPONENTS} or xwiki"
|
||||
fi
|
||||
|
||||
echo "Gathering passwords from UCS container ..."
|
||||
UCS_CONTAINER_NAME=$( \
|
||||
kubectl -n ${NAMESPACE} get pods --no-headers \
|
||||
--selector 'app.kubernetes.io/instance=univention-corporate-container' \
|
||||
| awk '{print $1}' \
|
||||
kubectl -n ${NAMESPACE} get pods --no-headers --selector \
|
||||
'app.kubernetes.io/instance=univention-corporate-container' \
|
||||
| grep Running \
|
||||
| awk '{print $1}' \
|
||||
)
|
||||
echo "UCS_CONTAINER_NAME: ${UCS_CONTAINER_NAME}"
|
||||
DEFAULT_USER_PASSWORD=$( \
|
||||
kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
|
||||
| grep DEFAULT_ACCOUNT_USER_PASSWORD \
|
||||
| awk '{print $2}' \
|
||||
)
|
||||
DEFAULT_ADMIN_PASSWORD=$( \
|
||||
DEFAULT_ADMIN_PASSWORD=$(
|
||||
kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
|
||||
| grep DEFAULT_ACCOUNT_ADMIN_PASSWORD \
|
||||
| awk '{print $2}' \
|
||||
)
|
||||
|
||||
echo "triggering test pipeline ..."
|
||||
curl -X POST \
|
||||
-F "ref=main" \
|
||||
-F "token=${CI_JOB_TOKEN}" \
|
||||
-F "variables[url]=https://portal.${DOMAIN}" \
|
||||
-F "variables[user_name]=${DEFAULT_USER_NAME}" \
|
||||
-F "variables[user_password]=${DEFAULT_USER_PASSWORD}" \
|
||||
-F "variables[admin_name]=${DEFAULT_ADMIN_NAME}" \
|
||||
-F "variables[admin_password]=${DEFAULT_ADMIN_PASSWORD}" \
|
||||
-F "variables[components]=\"${COMPONENTS}\"" \
|
||||
https://${TESTS_PROJECT_URL}/trigger/pipeline
|
||||
curl --request POST \
|
||||
--header "Content-Type: application/json" \
|
||||
--data "{ \
|
||||
\"ref\": \"${TESTS_BRANCH}\", \
|
||||
\"token\": \"${CI_JOB_TOKEN}\", \
|
||||
\"variables\": { \
|
||||
\"url\": \"https://portal.${DOMAIN}\", \
|
||||
\"user_name\": \"${DEFAULT_USER_NAME}\", \
|
||||
\"user_password\": \"${DEFAULT_USER_PASSWORD}\", \
|
||||
\"admin_name\": \"${DEFAULT_ADMIN_NAME}\", \
|
||||
\"admin_password\": \"${DEFAULT_ADMIN_PASSWORD}\", \
|
||||
\"DEPLOY_ALL_COMPONENTS\": \"${DEPLOY_ALL_COMPONENTS}\", \
|
||||
\"DEPLOY_COLLABORA\": \"${DEPLOY_COLLABORA}\", \
|
||||
\"DEPLOY_ELEMENT\": \"${DEPLOY_ELEMENT}\", \
|
||||
\"DEPLOY_ICS\": \"${DEPLOY_ICS}\", \
|
||||
\"DEPLOY_JITSI\": \"${DEPLOY_JITSI}\", \
|
||||
\"DEPLOY_KEYCLOAK\": \"${DEPLOY_KEYCLOAK}\", \
|
||||
\"DEPLOY_NEXTCLOUD\": \"${DEPLOY_NEXTCLOUD}\", \
|
||||
\"DEPLOY_OPENPROJECT\": \"${DEPLOY_OPENPROJECT}\", \
|
||||
\"DEPLOY_OX\": \"${DEPLOY_OX}\", \
|
||||
\"DEPLOY_SERVICES\": \"${DEPLOY_SERVICES}\", \
|
||||
\"DEPLOY_UCS\": \"${DEPLOY_UCS}\", \
|
||||
\"DEPLOY_XWIKI\": \"${DEPLOY_XWIKI}\", \
|
||||
\"DEPLOY_PROVISIONING\": \"${DEPLOY_PROVISIONING}\" \
|
||||
} \
|
||||
}" \
|
||||
"https://${TESTS_PROJECT_URL}/trigger/pipeline"
|
||||
|
||||
generate-release-assets:
|
||||
stage: "generate-release-assets"
|
||||
@@ -463,6 +463,7 @@ generate-release-assets:
|
||||
- when: "never"
|
||||
script:
|
||||
- |
|
||||
# yamllint disable-line rule:line-length
|
||||
git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/bmi/souveraener_arbeitsplatz/tooling/opendesk-asset-generator
|
||||
cd opendesk-asset-generator
|
||||
export OPENDESK_DEPLOYMENT_AUTOMATION_PATH=${CI_PROJECT_DIR}
|
||||
|
||||
62
CHANGELOG.md
62
CHANGELOG.md
@@ -1,3 +1,65 @@
|
||||
# [0.3.0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.10...v0.3.0) (2023-09-12)
|
||||
|
||||
|
||||
### Features
|
||||
|
||||
* **ci:** Selective tests ([d2e7ac9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/d2e7ac93481249e9eb7e5e1a41a6c6e333abe2dc))
|
||||
|
||||
## [0.2.10](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.9...v0.2.10) (2023-09-06)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **helmfile:** Add imagePullPolicy default env variable ([f988644](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/f9886448b60bbbd917b5ba04d188401275293eec))
|
||||
* **helmfile:** Update images and add jitsi, keycloak to security section in docs ([0eceb85](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/0eceb85e7df7455fa61cb17a854807069fbcf51a))
|
||||
* **jitsi:** Update chart to 1.4.2 with improved security and fixed change on each deployment ([1349181](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1349181d802ccb80d9e48cf50fe39f1505116c8e))
|
||||
* **jitsi:** Update jitsi to 1.5.1 and fix prosody image ([ed7e5e4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/ed7e5e428e5d9213a92f97dc03d72fa3e04334c2))
|
||||
* **keycloak:** Improve default security settings ([3b90533](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/3b90533063c151a9f3cdc9861a115481f6dc440a))
|
||||
* **nextcloud:** Fix yamllint disable comment ([4380e78](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/4380e789814ec2b0458fb2c341c8160ab2743afc))
|
||||
* **services:** Disable https redirect in istio to fix cert-manager issues ([1ef4a86](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1ef4a861acc955e2e85715c62f715a6629ada940))
|
||||
* **services:** Fix capabilities of postifix ([a6fa846](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/a6fa846afc9744f2b399c37cc754f878b6b9e90b))
|
||||
* **services:** Fix OCI registry address of postgresql, mariadb ([be82243](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/be822439661f766c4db6044fd3581db0cce214bb))
|
||||
|
||||
## [0.2.10](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.9...v0.2.10) (2023-09-06)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **helmfile:** Add imagePullPolicy default env variable ([f988644](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/f9886448b60bbbd917b5ba04d188401275293eec))
|
||||
* **helmfile:** Update images and add jitsi, keycloak to security section in docs ([0eceb85](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/0eceb85e7df7455fa61cb17a854807069fbcf51a))
|
||||
* **jitsi:** Update chart to 1.4.2 with improved security and fixed change on each deployment ([1349181](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1349181d802ccb80d9e48cf50fe39f1505116c8e))
|
||||
* **keycloak:** Improve default security settings ([3b90533](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/3b90533063c151a9f3cdc9861a115481f6dc440a))
|
||||
* **nextcloud:** Fix yamllint disable comment ([4380e78](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/4380e789814ec2b0458fb2c341c8160ab2743afc))
|
||||
* **services:** Disable https redirect in istio to fix cert-manager issues ([1ef4a86](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1ef4a861acc955e2e85715c62f715a6629ada940))
|
||||
* **services:** Fix capabilities of postifix ([a6fa846](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/a6fa846afc9744f2b399c37cc754f878b6b9e90b))
|
||||
* **services:** Fix OCI registry address of postgresql, mariadb ([be82243](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/be822439661f766c4db6044fd3581db0cce214bb))
|
||||
|
||||
## [0.2.9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.8...v0.2.9) (2023-09-05)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **collabora:** Add websocket support for NGINX Inc. Ingress ([6e5ef63](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6e5ef639c22aad93fd2d0eb75f7a1ffc00d6cc9a))
|
||||
* **docs:** Add security part in README ([ff462ab](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/ff462ab0dc2252cc7b517874f5337427b8d19053))
|
||||
* **docs:** Update scaling docs ([63a1e25](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/63a1e2568e8c5ff62081c6e6594d2019c1aa4b74))
|
||||
* **helmfile:** Reduce icap resources in default enviroment ([c5ab1b8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/c5ab1b81fecbce46788c50b282ed6d1770124fa5))
|
||||
* **helmfile:** Update clamav and nextcloud images in default environment ([4f2a8ae](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/4f2a8aeee4ee6c3d27b1c8a99bad14f603486be5))
|
||||
* **nextcloud:** Add support for up to 4G large upload for Ingress NGINX and NGINX Inc. Ingress ([6e68f7f](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6e68f7f28c937319d93f8afe1dbb302012f77233))
|
||||
* **nextcloud:** Rename sovereign-workplace-nextcloud-bootstrap to opendesk-nextcloud-bootstrap and use OCI ([cef11ac](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/cef11acbae28510809f9bfa13224dc3a6996207f))
|
||||
* **nextcloud:** Use clamav-icap when clamavDistributed is activated ([41d40c9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/41d40c9b731b866da2666fa4ffa8cb6493737112))
|
||||
* **services:** Enable security context and use default increased security settings ([9a6d240](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/9a6d2409a697f7e9811a0f4f8d31bb18bac1b926))
|
||||
* **services:** Fix image registry templates for postfix ([6321ff5](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6321ff50a00203abbfb7f5822e67a3c0e00d4b01))
|
||||
* **services:** Replace image digest by tag ([f758293](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/f7582932412f13b1a087d40459e97cf633b1a97e))
|
||||
* **services:** Set readOnlyRootFilesystem to true on master ([5fbf86b](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/5fbf86b6bc7b63c81b3ac07c5e0fa8cd464fdad1))
|
||||
* **services:** Update clamav to 4.0.0, redis to 18.0.0, postgresql to 2.0.2, mariadb to 2.0.2 and use OCI registries ([9d78664](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/9d7866480cee889fd3b3003b2eea313a6ed73344))
|
||||
|
||||
## [0.2.8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.7...v0.2.8) (2023-08-31)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **open-xchange:** Update images and Helm chart ([39565c7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/39565c7cfd89a8d1c2e645e3ecea28fba703ccc1))
|
||||
|
||||
## [0.2.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.6...v0.2.7) (2023-08-30)
|
||||
|
||||
|
||||
|
||||
89
README.md
89
README.md
@@ -280,30 +280,56 @@ the application to your own database instances.
|
||||
### Scaling
|
||||
|
||||
The Replicas of components can be increased, while we still have to look in the
|
||||
actual scalability of the components (see column `Scales at least to 2`).
|
||||
actual scalability of the components (see column `Scaling (verified)`).
|
||||
|
||||
| Component | Name | Default | Service | Scaling | Scales at least to 2 |
|
||||
|-------------|------------------------|---------|--------------------|--------------------|----------------------|
|
||||
| ClamAV | `replicas.clamav` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| | `replicas.clamd` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| | `replicas.freshclam` | `1` | :white_check_mark: | :x: | not tested |
|
||||
| | `replicas.icap` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| | `replicas.milter` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| Collabora | `replicas.collabora` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| Dovecot | `replicas.dovecot` | `1` | :white_check_mark: | :x: | not tested |
|
||||
| Element | `replicas.element` | `2` | :white_check_mark: | :white_check_mark: | :white_check_mark: |
|
||||
| | `replicas.synapse` | `1` | :white_check_mark: | :x: | not tested |
|
||||
| | `replicas.synapseWeb` | `2` | :white_check_mark: | :white_check_mark: | :white_check_mark: |
|
||||
| | `replicas.wellKnown` | `2` | :white_check_mark: | :white_check_mark: | :white_check_mark: |
|
||||
| Jitsi | `replicas.jibri` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| | `replicas.jicofo` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| | `replicas.jitsi ` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| | `replicas.jvb ` | `1` | :white_check_mark: | :x: | :x: |
|
||||
| Keycloak | `replicas.keycloak` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| Nextcloud | `replicas.nextcloud` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| OpenProject | `replicas.openproject` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| Postfix | `replicas.postfix` | `1` | :white_check_mark: | :x: | not tested |
|
||||
| XWiki | `replicas.xwiki` | `1` | :white_check_mark: | :white_check_mark: | not tested |
|
||||
| Component | Name | Scaling (effective) | Scaling (verified) |
|
||||
|-------------|------------------------|:-------------------:|:------------------:|
|
||||
| ClamAV | `replicas.clamav` | :white_check_mark: | :white_check_mark: |
|
||||
| | `replicas.clamd` | :white_check_mark: | :white_check_mark: |
|
||||
| | `replicas.freshclam` | :x: | :x: |
|
||||
| | `replicas.icap` | :white_check_mark: | :white_check_mark: |
|
||||
| | `replicas.milter` | :white_check_mark: | :white_check_mark: |
|
||||
| Collabora | `replicas.collabora` | :white_check_mark: | :gear: |
|
||||
| Dovecot | `replicas.dovecot` | :x: | :gear: |
|
||||
| Element | `replicas.element` | :white_check_mark: | :white_check_mark: |
|
||||
| | `replicas.synapse` | :x: | :gear: |
|
||||
| | `replicas.synapseWeb` | :white_check_mark: | :white_check_mark: |
|
||||
| | `replicas.wellKnown` | :white_check_mark: | :white_check_mark: |
|
||||
| Jitsi | `replicas.jibri` | :white_check_mark: | :gear: |
|
||||
| | `replicas.jicofo` | :white_check_mark: | :gear: |
|
||||
| | `replicas.jitsi ` | :white_check_mark: | :gear: |
|
||||
| | `replicas.jvb ` | :x: | :x: |
|
||||
| Keycloak | `replicas.keycloak` | :white_check_mark: | :gear: |
|
||||
| Nextcloud | `replicas.nextcloud` | :white_check_mark: | :gear: |
|
||||
| OpenProject | `replicas.openproject` | :white_check_mark: | :gear: |
|
||||
| Postfix | `replicas.postfix` | :x: | :gear: |
|
||||
| XWiki | `replicas.xwiki` | :white_check_mark: | :gear: |
|
||||
|
||||
|
||||
## Security
|
||||
|
||||
This list gives you an overview of default security settings and if they comply with security standards:
|
||||
|
||||
|
||||
| Component | Process | = | allowPrivilegeEscalation (`false`) | capabilities (`drop: ALL`) | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
|
||||
|------------|--------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
|
||||
| ClamAV | clamd | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | freshclam | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | icap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | milter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| Jitsi | jibri | :x: | :white_check_mark: | :x: (`SYS_ADMIN`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | jicofo | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | jitsiKeycloakAdapter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1993 | 1993 | - |
|
||||
| | jvb | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | prosody | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | web | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| Keycloak | keycloak | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| | keycloakConfigCli | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| | keycloakExtensionHandler | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | keycloakExtensionProxy | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| MariaDB | mariadb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| Postfix | postfix | :x: | :white_check_mark: | :x: (`DAC_OVERRIDE`, `FOWNER`, `SETUID`, `SETGID`, `NET_BIND_SERVICE`, `NET_ADMIN`, `NET_RAW`) | :white_check_mark: | :x: | :x: | - | - | 101 |
|
||||
| PostgreSQL | postgresql | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
|
||||
|
||||
# Component integration
|
||||
@@ -434,17 +460,14 @@ components we are going to cover various aspects:
|
||||
|
||||
## Tests
|
||||
|
||||
There is a frontend end-to-end test suite that can get triggered if the
|
||||
deployment is performed via a Gitlab pipeline.
|
||||
The gitlab-ci pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another gitlab project.
|
||||
The `DEPLOY_`-variables are used to determine which components should be tested.
|
||||
In order for the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this gitlab project's CI variables
|
||||
that can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
|
||||
`<domain of gitlab>/api/v4/projects/<id>`.
|
||||
|
||||
Currently, the test suite is in progress to be published, so right now it is
|
||||
only usable by project members. But that will change soon, and it could be used
|
||||
to create custom tests and perform them after deployment.
|
||||
|
||||
The deployment pipeline provides a variable named `TESTS_PROJECT_URL` that
|
||||
points to the test pipeline residing in another Gitlab repository. At the end of
|
||||
the deployment the test pipeline is triggered. Tests are just performed for
|
||||
components that have been deployed prior.
|
||||
If the branch of the test pipeline is not `main` this can be set with the .gitlab-ci.yml variable
|
||||
`TESTS_BRANCH` while creating a new pipeline.
|
||||
|
||||
|
||||
# Footnotes
|
||||
|
||||
@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
image:
|
||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.collabora.repository }}"
|
||||
tag: "{{ .Values.images.collabora.tag }}"
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
|
||||
@@ -26,7 +26,8 @@ ingress:
|
||||
http-request track-sc1 url_param(WOPISrc)
|
||||
stick match url_param(WOPISrc) if { var(txn.wopisrcconns) -m int gt 0 }
|
||||
stick store-request url_param(WOPISrc)
|
||||
|
||||
nginx.org/websocket-services: "collabora"
|
||||
nginx.org/lb-method: "hash $arg_WOPISrc consistent"
|
||||
autoscaling:
|
||||
enabled: false
|
||||
...
|
||||
|
||||
@@ -16,6 +16,7 @@ configuration:
|
||||
logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
|
||||
|
||||
image:
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.element.repository }}"
|
||||
tag: "{{ .Values.images.element.tag }}"
|
||||
|
||||
@@ -12,6 +12,7 @@ global:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
image:
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.synapseWeb.repository }}"
|
||||
tag: "{{ .Values.images.synapseWeb.tag }}"
|
||||
|
||||
@@ -12,6 +12,7 @@ global:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
image:
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.synapse.repository }}"
|
||||
tag: "{{ .Values.images.synapse.tag }}"
|
||||
|
||||
@@ -12,6 +12,7 @@ global:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
image:
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.wellKnown.repository }}"
|
||||
tag: "{{ .Values.images.wellKnown.tag }}"
|
||||
|
||||
@@ -29,6 +29,7 @@ ics:
|
||||
url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||
|
||||
image:
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.intercom.repository }}"
|
||||
tag: "{{ .Values.images.intercom.tag }}"
|
||||
|
||||
@@ -10,7 +10,7 @@ repositories:
|
||||
releases:
|
||||
- name: "jitsi"
|
||||
chart: "jitsi-repo/sovereign-workplace-jitsi"
|
||||
version: "1.4.1"
|
||||
version: "1.5.1"
|
||||
values:
|
||||
- "values-jitsi.gotmpl"
|
||||
condition: "jitsi.enabled"
|
||||
|
||||
@@ -12,6 +12,7 @@ global:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
image:
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.jitsiKeycloakAdapter.repository }}"
|
||||
tag: "{{ .Values.images.jitsiKeycloakAdapter.tag }}"
|
||||
@@ -118,6 +119,7 @@ patchJVB:
|
||||
staticLoadbalancerIP: "{{ .Values.cluster.networking.ingressGatewayIP }}"
|
||||
loadbalancerStatusField: "{{ .Values.cluster.networking.loadBalancerStatusField }}"
|
||||
image:
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.jitsiPatchJVB.repository }}"
|
||||
tag: "{{ .Values.images.jitsiPatchJVB.tag }}"
|
||||
|
||||
@@ -19,6 +19,7 @@ image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.keycloakBootstrap.repository }}"
|
||||
tag: "{{ .Values.images.keycloakBootstrap.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
resources:
|
||||
{{ .Values.resources.keycloakBootstrap | toYaml | nindent 2 }}
|
||||
|
||||
@@ -23,7 +23,7 @@ handler:
|
||||
{{- else if .Values.images.keycloakExtensionHandler.tag }}
|
||||
tag: "{{ .Values.images.keycloakExtensionHandler.tag }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: "Always"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
appConfig:
|
||||
smtpPassword: "{{ .Values.smtp.password }}"
|
||||
smtpHost: "{{ .Values.smtp.host }}"
|
||||
@@ -40,13 +40,10 @@ proxy:
|
||||
{{- else if .Values.images.keycloakExtensionProxy.tag }}
|
||||
tag: "{{ .Values.images.keycloakExtensionProxy.tag }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: "Always"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
ingress:
|
||||
enabled: "{{ .Values.ingress.enabled }}"
|
||||
ingressClassName: "{{ .Values.ingress.ingressClassName }}"
|
||||
annotations:
|
||||
nginx.org/proxy-buffer-size: "8k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
|
||||
host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||
tls:
|
||||
enabled: "{{ .Values.ingress.tls.enabled }}"
|
||||
|
||||
@@ -11,11 +11,35 @@ global:
|
||||
handler:
|
||||
appConfig:
|
||||
captchaProtectionEnable: "False"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
proxy:
|
||||
image:
|
||||
tag: "latest"
|
||||
ingress:
|
||||
annotations:
|
||||
nginx.org/proxy-buffer-size: "8k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
...
|
||||
|
||||
@@ -14,6 +14,7 @@ image:
|
||||
repository: "{{ .Values.images.keycloak.repository }}"
|
||||
tag: "{{ .Values.images.keycloak.tag }}"
|
||||
digest: "{{ .Values.images.keycloak.digest }}"
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
externalDatabase:
|
||||
host: "{{ .Values.databases.keycloak.host }}"
|
||||
@@ -81,6 +82,8 @@ keycloakConfigCli:
|
||||
value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.keycloak }}
|
||||
- name: "LDAPSEARCH_USERNAME"
|
||||
value: "ldapsearch_keycloak"
|
||||
resources:
|
||||
{{ .Values.resources.keycloak | toYaml | nindent 4 }}
|
||||
|
||||
resources:
|
||||
{{ .Values.resources.keycloak | toYaml | nindent 2 }}
|
||||
|
||||
@@ -54,5 +54,32 @@ keycloakConfigCli:
|
||||
- "--import.var-substitution.enabled=true"
|
||||
cache:
|
||||
enabled: false
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: false
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
|
||||
podSecurityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: "OnRootMismatch"
|
||||
...
|
||||
|
||||
@@ -2,19 +2,22 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
repositories:
|
||||
- name: "sovereign-workplace-nextcloud-bootstrap-repo"
|
||||
- name: "opendesk-nextcloud-bootstrap-repo"
|
||||
oci: true
|
||||
# yamllint disable rule:line-length
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
default "https://gitlab.souvap-univention.de/api/v4/projects/130/packages/helm/stable" }}
|
||||
{{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
|
||||
"external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-nextcloud-bootstrap" }}
|
||||
# yamllint enable rule:line-length
|
||||
- name: "nextcloud-repo"
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
default "https://nextcloud.github.io/helm/" }}
|
||||
|
||||
releases:
|
||||
- name: "sovereign-workplace-nextcloud-bootstrap"
|
||||
chart: "sovereign-workplace-nextcloud-bootstrap-repo/sovereign-workplace-nextcloud-bootstrap"
|
||||
version: "2.3.0"
|
||||
- name: "opendesk-nextcloud-bootstrap"
|
||||
chart: "opendesk-nextcloud-bootstrap-repo/opendesk-nextcloud-bootstrap"
|
||||
version: "3.0.0"
|
||||
wait: true
|
||||
waitForJobs: true
|
||||
values:
|
||||
@@ -27,7 +30,7 @@ releases:
|
||||
chart: "nextcloud-repo/nextcloud"
|
||||
version: "3.5.19"
|
||||
needs:
|
||||
- "sovereign-workplace-nextcloud-bootstrap"
|
||||
- "opendesk-nextcloud-bootstrap"
|
||||
values:
|
||||
- "values-nextcloud.gotmpl"
|
||||
- "values-nextcloud.yaml"
|
||||
|
||||
@@ -18,7 +18,7 @@ config:
|
||||
|
||||
antivirus:
|
||||
{{- if .Values.clamavDistributed.enabled }}
|
||||
host: "clamav-sovereign-workplace-icap"
|
||||
host: "clamav-icap"
|
||||
{{- else if .Values.clamavSimple.enabled }}
|
||||
host: "clamav-simple"
|
||||
{{- end }}
|
||||
@@ -44,6 +44,7 @@ config:
|
||||
password: "{{ .Values.smtp.password }}"
|
||||
|
||||
image:
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.nextcloud.repository }}"
|
||||
tag: "{{ .Values.images.nextcloud.tag }}"
|
||||
|
||||
@@ -25,7 +25,7 @@ ingress:
|
||||
- "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
|
||||
image:
|
||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.nextcloud.repository }}"
|
||||
pullPolicy: "Always"
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
tag: "{{ .Values.images.nextcloud.tag }}"
|
||||
pullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
@@ -21,6 +21,11 @@ cronjob:
|
||||
sed -i "s/\*\/5 \* \* \* \* php -f \/var\/www\/html\/cron.php/\*\/1 \* \* \* \* php -f
|
||||
\/var\/www\/html\/cron.php/g" /var/spool/cron/crontabs/www-data
|
||||
|
||||
ingress:
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "4G"
|
||||
nginx.org/client-max-body-size: "4G"
|
||||
|
||||
internalDatabase:
|
||||
enabled: false
|
||||
postgresql:
|
||||
|
||||
@@ -26,7 +26,7 @@ releases:
|
||||
condition: "dovecot.enabled"
|
||||
- name: "open-xchange"
|
||||
chart: "openxchange-repo/appsuite-public-sector/charts/appsuite-public-sector"
|
||||
version: "1.2.13"
|
||||
version: "2.0.3"
|
||||
values:
|
||||
- "values-openxchange.yaml"
|
||||
- "values-openxchange.gotmpl"
|
||||
|
||||
@@ -7,6 +7,7 @@ image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
url: "{{ .Values.images.dovecot.repository }}"
|
||||
digest: "{{ .Values.images.dovecot.digest }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
|
||||
@@ -7,6 +7,7 @@ image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
url: "{{ .Values.images.openxchangeBootstrap.repository }}"
|
||||
digest: "{{ .Values.images.openxchangeBootstrap.digest }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
|
||||
@@ -34,6 +34,7 @@ public-sector-ui:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
appsuite:
|
||||
istio:
|
||||
@@ -96,6 +97,7 @@ appsuite:
|
||||
image:
|
||||
repository: {{ .Values.images.openxchangeCoreMW.repository }}
|
||||
tag: {{ .Values.images.openxchangeCoreMW.tag }}
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
update:
|
||||
image:
|
||||
repository: {{ .Values.images.openxchangeCoreMW.repository }}
|
||||
@@ -113,6 +115,7 @@ appsuite:
|
||||
image:
|
||||
repository: {{ .Values.images.openxchangeCoreUI.repository }}
|
||||
tag: {{ .Values.images.openxchangeCoreUI.tag }}
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
core-ui-middleware:
|
||||
ingress:
|
||||
@@ -126,6 +129,7 @@ appsuite:
|
||||
image:
|
||||
repository: {{ .Values.images.openxchangeCoreUIMiddleware.repository }}
|
||||
tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag }}
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
core-guidedtours:
|
||||
imagePullSecrets:
|
||||
@@ -135,6 +139,7 @@ appsuite:
|
||||
image:
|
||||
repository: {{ .Values.images.openxchangeCoreGuidedtours.repository }}
|
||||
tag: {{ .Values.images.openxchangeCoreGuidedtours.tag }}
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
guard-ui:
|
||||
imagePullSecrets:
|
||||
@@ -144,11 +149,13 @@ appsuite:
|
||||
image:
|
||||
repository: {{ .Values.global.imageRegistry }}/{{ .Values.images.openxchangeGuardUI.repository }}
|
||||
tag: {{ .Values.images.openxchangeGuardUI.tag }}
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
core-user-guide:
|
||||
image:
|
||||
repository: {{ .Values.images.openxchangeCoreUserGuide.repository }}
|
||||
tag: {{ .Values.images.openxchangeCoreUserGuide.tag }}
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
|
||||
@@ -55,13 +55,17 @@ appsuite:
|
||||
com.openexchange.mail.filter.server: "dovecot"
|
||||
com.openexchange.mail.filter.preferredSaslMech: "XOAUTH2"
|
||||
# Capabilities
|
||||
# Old capability can be used to toggle all integrations with a single switch
|
||||
com.openexchange.capability.public-sector: "true"
|
||||
# New capabilities in 2.0
|
||||
com.openexchange.capability.public-sector-element: "false"
|
||||
com.openexchange.capability.public-sector-navigation: "true"
|
||||
com.openexchange.capability.client-onboarding: "true"
|
||||
com.openexchange.capability.dynamic-theme: "true"
|
||||
com.openexchange.capability.filestorage_nextcloud: "true"
|
||||
com.openexchange.capability.filestorage_nextcloud_oauth: "true"
|
||||
com.openexchange.capability.guard: "true"
|
||||
com.openexchange.capability.guard-mail: "true"
|
||||
com.openexchange.capability.public-sector: "true"
|
||||
com.openexchange.capability.smime: "true"
|
||||
com.openexchange.capability.share_links: "false"
|
||||
com.openexchange.capability.invite_guests: "false"
|
||||
@@ -95,6 +99,11 @@ appsuite:
|
||||
bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
|
||||
|
||||
uiSettings:
|
||||
# Show the Enterprise Picker in the top right corner instead of the launcher drop-down
|
||||
io.ox/core//features/enterprisePicker/showLauncher: "false"
|
||||
io.ox/core//features/enterprisePicker/showTopRightLauncher: "true"
|
||||
# Text and icon color in the topbar
|
||||
io.ox/dynamic-theme//topbarColor: "#000"
|
||||
io.ox/dynamic-theme//logoWidth: "82"
|
||||
io.ox/dynamic-theme//topbarHover: "rgba(0, 0, 0, 0.1)"
|
||||
# Resources
|
||||
|
||||
@@ -10,7 +10,7 @@ global:
|
||||
image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.openproject.repository }}"
|
||||
pullPolicy: "Always"
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
tag: "{{ .Values.images.openproject.tag }}"
|
||||
|
||||
memcached:
|
||||
|
||||
@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.oxConnector.repository }}"
|
||||
pullPolicy: "Always"
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
tag: "{{ .Values.images.oxConnector.tag }}"
|
||||
|
||||
imagePullSecrets:
|
||||
|
||||
@@ -7,13 +7,15 @@ repositories:
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
default "https://gitlab.souvap-univention.de/api/v4/projects/133/packages/helm/stable" }}
|
||||
- name: "postgresql-repo"
|
||||
oci: true
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
default "https://gitlab.souvap-univention.de/api/v4/projects/83/packages/helm/stable" }}
|
||||
{{ env "PRIVATE_IMAGE_REGISTRY_URL" |
|
||||
default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/postgresql" }}
|
||||
- name: "mariadb-repo"
|
||||
oci: true
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
default "https://gitlab.souvap-univention.de/api/v4/projects/86/packages/helm/stable" }}
|
||||
{{ env "PRIVATE_IMAGE_REGISTRY_URL" |
|
||||
default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/mariadb" }}
|
||||
- name: "postfix-repo"
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
@@ -23,13 +25,14 @@ repositories:
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
default "https://gitlab.souvap-univention.de/api/v4/projects/69/packages/helm/stable" }}
|
||||
- name: "clamav-repo"
|
||||
oci: true
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
default "https://gitlab.souvap-univention.de/api/v4/projects/73/packages/helm/stable" }}
|
||||
{{ env "PRIVATE_IMAGE_REGISTRY_URL" |
|
||||
default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/clamav" }}
|
||||
- name: "bitnami-repo"
|
||||
oci: true
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
{{ env "PRIVATE_IMAGE_REGISTRY_URL" |
|
||||
default "registry-1.docker.io/bitnamicharts" }}
|
||||
|
||||
releases:
|
||||
@@ -41,41 +44,41 @@ releases:
|
||||
condition: "certificates.enabled"
|
||||
- name: "redis"
|
||||
chart: "bitnami-repo/redis"
|
||||
version: "17.9.3"
|
||||
version: "18.0.0"
|
||||
values:
|
||||
- "values-redis.gotmpl"
|
||||
- "values-redis.yaml"
|
||||
condition: "redis.enabled"
|
||||
- name: "postgresql"
|
||||
chart: "postgresql-repo/postgresql"
|
||||
version: "2.0.0"
|
||||
version: "2.0.2"
|
||||
values:
|
||||
- "values-postgresql.yaml"
|
||||
- "values-postgresql.gotmpl"
|
||||
condition: "postgresql.enabled"
|
||||
- name: "mariadb"
|
||||
chart: "mariadb-repo/mariadb"
|
||||
version: "2.0.0"
|
||||
version: "2.0.2"
|
||||
values:
|
||||
- "values-mariadb.yaml"
|
||||
- "values-mariadb.gotmpl"
|
||||
condition: "mariadb.enabled"
|
||||
- name: "postfix"
|
||||
chart: "postfix-repo/postfix"
|
||||
version: "1.13.0"
|
||||
version: "2.0.1"
|
||||
values:
|
||||
- "values-postfix.yaml"
|
||||
- "values-postfix.gotmpl"
|
||||
condition: "postfix.enabled"
|
||||
- name: "clamav"
|
||||
chart: "clamav-repo/sovereign-workplace-clamav"
|
||||
version: "2.1.0"
|
||||
chart: "clamav-repo/opendesk-clamav"
|
||||
version: "4.0.0"
|
||||
values:
|
||||
- "values-clamav-distributed.gotmpl"
|
||||
condition: "clamavDistributed.enabled"
|
||||
- name: "clamav-simple"
|
||||
chart: "clamav-repo/clamav-simple"
|
||||
version: "2.1.0"
|
||||
version: "4.0.0"
|
||||
values:
|
||||
- "values-clamav-simple.gotmpl"
|
||||
condition: "clamavSimple.enabled"
|
||||
@@ -83,6 +86,7 @@ releases:
|
||||
chart: "istio-resources-repo/istio-gateway"
|
||||
version: "1.1.2"
|
||||
values:
|
||||
- "values-istio-gateway.yaml"
|
||||
- "values-istio-gateway.gotmpl"
|
||||
condition: "istio.enabled"
|
||||
|
||||
|
||||
@@ -5,25 +5,23 @@ SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
clamd:
|
||||
podSecurityContext:
|
||||
{{/* Disabled until NFS Provisioner on IONOS is fixed */}}
|
||||
enabled: false
|
||||
replicaCount: {{ .Values.replicas.clamd }}
|
||||
image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.clamd.repository }}"
|
||||
tag: "{{ .Values.images.clamd.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
resources:
|
||||
{{ .Values.resources.clamd | toYaml | nindent 4 }}
|
||||
|
||||
freshclam:
|
||||
podSecurityContext:
|
||||
{{/* Disabled until NFS Provisioner on IONOS is fixed */}}
|
||||
enabled: false
|
||||
replicaCount: {{ .Values.replicas.freshclam }}
|
||||
image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.freshclam.repository }}"
|
||||
tag: "{{ .Values.images.freshclam.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
resources:
|
||||
{{ .Values.resources.freshclam | toYaml | nindent 4 }}
|
||||
|
||||
@@ -37,18 +35,18 @@ icap:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.icap.repository }}"
|
||||
tag: "{{ .Values.images.icap.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
resources:
|
||||
{{ .Values.resources.icap | toYaml | nindent 4 }}
|
||||
|
||||
milter:
|
||||
podSecurityContext:
|
||||
{{/* Disabled until NFS Provisioner on IONOS is fixed */}}
|
||||
enabled: false
|
||||
replicaCount: {{ .Values.replicas.milter }}
|
||||
image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.milter.repository }}"
|
||||
tag: "{{ .Values.images.milter.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
resources:
|
||||
{{ .Values.resources.milter | toYaml | nindent 4 }}
|
||||
|
||||
|
||||
@@ -3,11 +3,6 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
|
||||
podSecurityContext:
|
||||
{{/* Disabled until NFS Provisioner on IONOS is fixed */}}
|
||||
enabled: false
|
||||
|
||||
replicaCount: {{ .Values.replicas.clamav }}
|
||||
|
||||
image:
|
||||
@@ -15,10 +10,12 @@ image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.clamd.repository }}"
|
||||
tag: "{{ .Values.images.clamd.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
icap:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.icap.repository }}"
|
||||
tag: "{{ .Values.images.icap.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
resources:
|
||||
{{ .Values.resources.clamd | toYaml | nindent 4 }}
|
||||
|
||||
6
helmfile/apps/services/values-istio-gateway.yaml
Normal file
6
helmfile/apps/services/values-istio-gateway.yaml
Normal file
@@ -0,0 +1,6 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
tls:
|
||||
httpsRedirect: false
|
||||
...
|
||||
@@ -11,6 +11,7 @@ global:
|
||||
image:
|
||||
repository: "{{ .Values.images.mariadb.repository }}"
|
||||
tag: "{{ .Values.images.mariadb.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
# Open-Xchange and XWiki require the permission to create database schemas, so they use the `root` account anyway.
|
||||
# Please refer to `databases.yaml` for details.
|
||||
|
||||
@@ -3,14 +3,16 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
image:
|
||||
url: "{{ .Values.global.imageRegistry }}/{{ .Values.images.postfix.repository }}"
|
||||
digest: "{{ .Values.images.postfix.digest }}"
|
||||
global:
|
||||
registry: {{ .Values.global.imageRegistry }}
|
||||
imagePullSecrets:
|
||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry }}
|
||||
repository: "{{ .Values.images.postfix.repository }}"
|
||||
tag: "{{ .Values.images.postfix.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
certificate:
|
||||
secretName: "{{ .Values.ingress.tls.secretName }}"
|
||||
|
||||
@@ -11,6 +11,7 @@ global:
|
||||
image:
|
||||
repository: "{{ .Values.images.postgresql.repository }}"
|
||||
tag: "{{ .Values.images.postgresql.tag }}"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
job:
|
||||
users:
|
||||
|
||||
@@ -16,6 +16,7 @@ image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.redis.repository }}"
|
||||
tag: "{{ .Values.images.redis.tag }}"
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
master:
|
||||
persistence:
|
||||
|
||||
@@ -8,4 +8,8 @@ sentinel:
|
||||
|
||||
metrics:
|
||||
enabled: false
|
||||
|
||||
master:
|
||||
containerSecurityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
...
|
||||
|
||||
@@ -13,7 +13,7 @@ global:
|
||||
|
||||
image:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
imagePullPolicy: "Always"
|
||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
repository: "{{ .Values.images.univentionCorporateServer.repository }}"
|
||||
tag: "{{ .Values.images.univentionCorporateServer.tag }}"
|
||||
|
||||
|
||||
@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
image:
|
||||
name: "{{ .Values.global.imageRegistry }}/{{ .Values.images.xwiki.repository }}"
|
||||
tag: "{{ .Values.images.xwiki.tag }}"
|
||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||
|
||||
externalDB:
|
||||
password: "{{ .Values.databases.xwiki.password | default .Values.secrets.mariadb.rootPassword }}"
|
||||
|
||||
@@ -39,4 +39,8 @@ global:
|
||||
imagePullSecrets:
|
||||
- "external-registry"
|
||||
|
||||
## Define the policy to pull container images.
|
||||
## Ref: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
|
||||
#
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
...
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
images:
|
||||
clamd:
|
||||
repository: "clamav/clamav"
|
||||
tag: "1.1.0_base"
|
||||
tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
|
||||
collabora:
|
||||
# repository: "collabora/code"
|
||||
# tag: "23.05.2.2.1"
|
||||
@@ -18,28 +18,28 @@ images:
|
||||
tag: "16506bba9da546b1bf5896892f6f4afefea3d0f1d8ed93eae511212627a029b9"
|
||||
freshclam:
|
||||
repository: "clamav/clamav"
|
||||
tag: "1.1.0_base"
|
||||
tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
|
||||
jibri:
|
||||
repository: "jitsi/jibri"
|
||||
tag: "stable-8615"
|
||||
tag: "stable-8922@sha256:87aa176b44b745b13769f13b8e2d22ddd6f6ba624244d5354c8dd3664787e936"
|
||||
jicofo:
|
||||
repository: "jitsi/jicofo"
|
||||
tag: "stable-8615"
|
||||
tag: "stable-8922@sha256:820fcd4b072b29f42c1c37389fbefda1065f1e9654694941485dc08123c8a93b"
|
||||
jitsi:
|
||||
repository: "jitsi/web"
|
||||
tag: "stable-8615"
|
||||
tag: "stable-8922@sha256:24bd4179998fe01ace1be74e53fea5308f4d91722953bb4334611e6886753f46"
|
||||
jitsiKeycloakAdapter:
|
||||
repository: "nordeck/jitsi-keycloak-adapter"
|
||||
tag: "v20230816"
|
||||
tag: "v20230906@sha256:54d45ee1a1205f98641810ffb171bd92e6478e2957a349ee4ff599359239fbf2"
|
||||
jitsiPatchJVB:
|
||||
repository: "bitnami/kubectl"
|
||||
tag: "1.26.6"
|
||||
tag: "1.26.8@sha256:c6902a1fdce0a24c9f93ac8d1f317039b206a4b307d8fc76cab4a92911345757"
|
||||
jvb:
|
||||
repository: "jitsi/jvb"
|
||||
tag: "stable-8615"
|
||||
tag: "stable-8922@sha256:75dd613807e19cbbd440d071b60609fa9e4ee50a1396b14deb0ed779d882a554"
|
||||
icap:
|
||||
repository: "souvap/tooling/images/c-icap/c-icap-clamav"
|
||||
tag: "1.0.4"
|
||||
repository: "souvap/tooling/images/c-icap"
|
||||
tag: "0.5.10@sha256:cd665e77a42460bb1e6df4282bc1d8737be241fc9f4143d43509e31de3a7993d"
|
||||
intercom:
|
||||
repository: "univention/intercom-service"
|
||||
tag: "1.4-kubernetes"
|
||||
@@ -64,10 +64,10 @@ images:
|
||||
tag: "1.6.21-debian-11-r4"
|
||||
milter:
|
||||
repository: "clamav/clamav"
|
||||
tag: "1.1.0_base"
|
||||
tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
|
||||
nextcloud:
|
||||
repository: "nextcloud"
|
||||
tag: "26.0.1-apache"
|
||||
tag: "26.0.5-apache"
|
||||
openproject:
|
||||
repository: "souvap/tooling/images/openproject/souvap@sha256"
|
||||
tag: "5da1ae8be3d7483bf0f3d9ec50c3470586528e0ff51b663e2c3a57bceb489423"
|
||||
@@ -76,40 +76,40 @@ images:
|
||||
digest: "sha256:199a4457602b4e260d9781358cd2e342f63c177f4bcfa8053493be01e57beddf"
|
||||
openxchangeCoreGuidedtours:
|
||||
repository: "appsuite-public-sector/core-guidedtours"
|
||||
tag: "8.5.0"
|
||||
tag: "8.5.1"
|
||||
openxchangeCoreMW:
|
||||
repository: "appsuite-public-sector/middleware-public-sector"
|
||||
tag: "8.15.43"
|
||||
tag: "8.16.55"
|
||||
openxchangeCoreUI:
|
||||
repository: "appsuite-public-sector/core-ui"
|
||||
tag: "8.15.2"
|
||||
tag: "8.16.5"
|
||||
openxchangeCoreUIMiddleware:
|
||||
repository: "appsuite-public-sector/core-ui-middleware"
|
||||
tag: "1.8.3"
|
||||
tag: "1.8.4"
|
||||
openxchangeCoreUserGuide:
|
||||
repository: "appsuite-public-sector/core-user-guide"
|
||||
tag: "8.15.702039"
|
||||
tag: "8.16.727397"
|
||||
openxchangeGuardUI:
|
||||
repository: "appsuite-public-sector/guard-ui"
|
||||
tag: "4.0.5"
|
||||
tag: "4.0.6"
|
||||
openxchangeNextcloudIntegrationUI:
|
||||
repository: "appsuite-public-sector/nextcloud-integration-ui"
|
||||
tag: "1.0.2"
|
||||
tag: "1.0.3"
|
||||
openxchangePublicSectorUI:
|
||||
repository: "appsuite-public-sector/public-sector-ui"
|
||||
tag: "1.0.3"
|
||||
tag: "2.0.1"
|
||||
oxConnector:
|
||||
repository: "souvap/tooling/images/ox-connector/ox-connector-standalone"
|
||||
tag: "branch-jconde-listener-entrypoint-chaining"
|
||||
postfix:
|
||||
repository: "souvap/tooling/images/postfix"
|
||||
digest: "sha256:69e0c53ade77ffb89673672f5c8183ec2edfc81d4e990aca3ec594f33c55a7ac"
|
||||
tag: "1.0.0@sha256:69e0c53ade77ffb89673672f5c8183ec2edfc81d4e990aca3ec594f33c55a7ac"
|
||||
postgresql:
|
||||
repository: "postgres"
|
||||
tag: "15-alpine"
|
||||
prosody:
|
||||
repository: "jitsi/prosody"
|
||||
tag: "stable-8615"
|
||||
tag: "stable-8922@sha256:243547f24ae7d686d1f0c18ee230cf93119a66f095dda282bacbf45d4bb69f77"
|
||||
redis:
|
||||
repository: "bitnami/redis"
|
||||
tag: "7.0.12-debian-11-r0"
|
||||
|
||||
@@ -8,7 +8,7 @@ replicas:
|
||||
clamd: 1
|
||||
collabora: 1
|
||||
dovecot: 1
|
||||
element: 2
|
||||
element: 1
|
||||
# clamav-distributed
|
||||
freshclam: 1
|
||||
# clamav-distributed
|
||||
@@ -25,7 +25,7 @@ replicas:
|
||||
openproject: 1
|
||||
postfix: 1
|
||||
synapse: 1
|
||||
synapseWeb: 2
|
||||
wellKnown: 2
|
||||
synapseWeb: 1
|
||||
wellKnown: 1
|
||||
xwiki: 1
|
||||
...
|
||||
|
||||
@@ -33,10 +33,10 @@ resources:
|
||||
icap:
|
||||
limits:
|
||||
cpu: 2
|
||||
memory: "4Gi"
|
||||
memory: "128Mi"
|
||||
requests:
|
||||
cpu: 0.1
|
||||
memory: "2Gi"
|
||||
memory: "16Mi"
|
||||
jibri:
|
||||
limits:
|
||||
cpu: 1
|
||||
|
||||
Reference in New Issue
Block a user